Cookies
Last updated 16 September 2026
This is a draft. It describes accurately what the software does with data and money. It has not been reviewed by a lawyer, and nothing here should be read as a claim that Aegis is compliant with the law of any particular country until that review has happened.
Two cookies, and that is all
| Name | Purpose | Lifetime |
|---|---|---|
| aegis_at | Your access token. Sent with each request so the server knows who you are. | 14 minutes |
| aegis_rt | Your refresh token. Used to get a new access token so you are not signed out every quarter of an hour. | 30 days |
Both are httpOnly, so JavaScript in the page cannot read them — which is what stops a script injection from stealing a session. Both are SameSite=Lax, and both are marked secure in production.
Why there is no cookie banner
Both cookies are strictly necessary to sign you in. There is no analytics script on this site, no advertising pixel, no session recorder, and no third-party tag of any kind — so there is nothing to ask your consent for, and a banner would be asking permission for something we are not doing.
If we ever add an analytics or marketing cookie, this page will say so before it appears, and it will be off until you agree.
Local storage
The product keeps a small amount of information in your browser’s local storage — the last table view you chose, a collapsed panel, a draft you were typing. It never holds a token or anybody’s personal data, it never leaves your device, and clearing your browser data removes it.
Turning them off
You can block cookies in your browser. Blocking these two means you cannot stay signed in, because they are the sign-in. Clearing them signs you out, which is a perfectly good way to sign out on a shared computer — though ending the session from your security settings is better, since that revokes it on the server rather than just forgetting it here.